Store, share and sync your .env secrets: encrypted per project, organized by environment, shared with exactly the right people and delivered to your terminal, GitHub and AWS. Here is each feature in a sentence or two.
One encrypted home for every .env value, per project and per environment.
# Production settings
DATABASE_URL="postgres://app:example@db.internal:5432/app"
REDIS_URL=redis://cache.internal:6379
export FEATURE_FLAGS=checkout,search
MAIL_FROM="ACME <no-reply@example.com>"Drag and drop a .env or .txt file
Example · move a .env file into ProductEnv
export prefixes, quotes and multi-line values are understood.productenv pull.Every value is encrypted with AES-256-GCM under its own project key, which is itself wrapped by a master key that never lives in the database.
Each project starts with development, staging and production. Add your own, put them in the order your team works in, compare them to find missing keys, and delete the ones you no longer need.
Drag and drop or paste a .env file, check which keys are new and which will be updated, then import them all at once. Download any environment back as a .env file.
Get told when a teammate adds, updates or deletes secrets, or creates or deletes an environment, in a project you work on.
Group projects by organization and give every person exactly the access they need.
Invite people
Example · a read-only role for CI
The project owner can do everything. On ENV+ (trial included) and Custom plans, the organization owner can change what Admin, Member and Guest are allowed to do, or reset them to these defaults:
| Permission | Admin | Member | Guest |
|---|---|---|---|
| View secretsSee and reveal secrets, download .env files and pull with the CLI. | |||
| Edit secretsAdd, update, import and delete secrets, and push with the CLI. | |||
| Create environmentsAdd environment types to the project (ENV+). | |||
| Manage environmentsReorder environment types, and delete them with their secrets. | |||
| Compare environmentsSee which keys each environment is missing (key names only, never values). | |||
| Sync GitHubPush secrets to the connected GitHub repository. | |||
| Manage AWSConnect, sync and disconnect AWS Elastic Beanstalk. | |||
| Open settingsOpen the project settings pages. | |||
| Manage peopleInvite people, cancel invitations, and give, change or remove roles that stay within your own permissions and cannot manage people. |
A personal workspace is created for you when you sign up. Create more organizations, rename them and switch between them from the sidebar.
Keep each app or service in its own project, with its secrets, environments, team and integrations.
One page lists everyone in the organization with their project access and pending invitations. One invitation carries the organization role and any project access, granted together when it is accepted.
Built-in Admin, Member and Guest roles cover 9 project permissions, from viewing secrets to managing the team. Every action in the dashboard and the CLI checks them.
Create roles of your own with exactly the permissions a person needs, for example a CI reader that can only pull secrets. Each role is a small monthly add-on, prorated to your plan period.
Bring secrets to your terminal, your pipeline and your hosting without copying them by hand.
productenv login
🔐 Logged in successfully as jana@example.com
productenv init --org acme --project api-gateway --env development
productenv pull
✅ Pulled 14 secrets from api-gateway/development → .env
# edit .env, then review the change before uploading it
productenv push
📦 .env → api-gateway/development (merge)
+ SENTRY_DSN
~ DATABASE_URL
1 added, 1 updated, 0 removed, 12 unchanged
✔ Push these changes to api-gateway/development? Yes
✅ Pushed: 1 created, 1 updated, 0 deletedname: Deploy
on:
push:
branches: [main]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
# Synced from ProductEnv: the whole production .env in one secret.
- name: Write .env
run: echo "${{ secrets.PRODUCT_ENV_PRODUCTION_SECRETS }}" > .env
- run: npm ci && npm run buildpush shows what will change by key name only (+ new, ~ changed) and asks before writing; values are never printed. GitHub sync stores the environment's whole .env in one Actions secret named PRODUCT_ENV_<ENVIRONMENT>_SECRETS, encrypted with your repository's key; Elastic Beanstalk sync sets each secret as an environment property.
Sign in through your browser, link a folder to a project, then pull secrets into .env or push local changes back after reviewing the diff.
Install the ProductEnv GitHub App, connect a repository to a project and sync an environment's secrets to the repository's GitHub Actions secrets.
Connect an Elastic Beanstalk environment and send an environment's secrets to it as environment properties. Your AWS keys are checked on connect and stored encrypted, and only people who can view secrets can connect or sync.
Start free, upgrade when you need more, and pay locally in US dollars or Lebanese pounds.
| Limit | Basic | ENV+ | Custom |
|---|---|---|---|
| Projects per organization | 3 | 5 | Tailored |
| Environments per project | 1 | 6 | Tailored |
| Secrets per environment | 20 | 50 | Tailored |
| People per organization | 3 | 30 | Tailored |
Upgrade to ENV+
USD balance
$45.01
LBP balance
LBP 0
Example · upgrading during the 30-day trial
Everything a small team needs to stop sharing .env files in chat: 3 projects, 3 people and 20 secrets per environment.
Your ENV+ trial starts automatically when you create your first project. No payment details needed.
ENV+ unlocks every environment, more projects and a bigger team, billed monthly or yearly. The Custom plan brings tailored limits for larger organizations.
Pay in USD or LBP: scan the QR code on Whish's payment page with the Whish app, or type in the code it shows. Your plan turns on as soon as Whish confirms.
Your wallet belongs to your account, not to an organization. Top it up with Whish, then pay plans and custom roles from it with no fee.
Every plan and custom role payment in one list, with a PDF invoice for each paid one and refunds marked when our team issues them.
Sign in without a password, stay informed and reach us from inside the dashboard.
Sign in to ProductEnv
Sign in with a magic link sent to your email, or with Google or GitHub. There is no password to remember or leak.
An inbox in the dashboard, browser push notifications and cards in the open tab for invitations, new access, people joining, payments, price changes, support replies and announcements.
Open a support ticket from the dashboard and follow the conversation with our team in one thread.
Suggest a feature or report a bug, then follow its status and our team's note on it.
Pick the dashboard theme from the profile menu, or let it follow your system.
Edit your profile at any time, or delete your account and the organizations you own. Only billing records are kept, for legal reasons.